SEC-013
Git repository metadata publicly accessible
HighDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
Public .git metadata lets anyone download your repository history, including source code, old commits and any secrets that were ever committed. Block the /.git path at the server or host, deploy only the build output, and rotate any credential that appears anywhere in the git history.
In apps built with AI tools
Usually a deploy that copies the working folder to a server (FTP, rsync or a simple VPS setup) instead of a build artifact.
What it checks
GET requests for /.git/HEAD and /.git/config.
Why it matters
An exposed .git folder lets anyone reconstruct your source code, history and any secrets ever committed.
Recommended fix
Block access to /.git on the server and remove the folder from the deployed output.
How to verify
Request /.git/HEAD on the live site and confirm a 404.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-013: Git repository metadata publicly accessible
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: The deployed site serves files from the .git directory. Make sure the deploy output never includes .git, and add a server or hosting rule that returns 404 for any path starting with /.git. Then check git history for committed secrets.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request /.git/HEAD on the live site and confirm a 404.Questions
- How do I check my history for secrets?
- Run a tool such as gitleaks or trufflehog over the whole history, not just the current files.